Yet another explicit nulling in _fetch_xform() -- it turns out that allowing username+id_string as a fall-back is nontrivial